How GuardDuty Protects S3 from Malware

TechOps Examples

Hey — It's Govardhana MK 👋

Along with a use case deep dive, we identify the top news, tools, videos, and articles in the TechOps industry.

IN TODAY'S EDITION

🧠 Use Case

• How GuardDuty Protects S3 from Malware

🚀 Top News

• GitHub, Telegram Bots, and ASCII QR Codes Abused in New Wave of Phishing Attacks

📽️ Videos

• Monolith vs Microservices - Dave Farley - GOTO 2024

• Kubernetes LoadBalancer Service for External Access

📚️ Resources

• A Beginner's Guide to Using AWS CloudTrail

• Git: avoid reset --hard, use reset --keep instead

• How To Use Prometheus To Efficiently Detect Anomalies At Scale

🛠️ TOOL OF THE DAY

nuclei - Fast and customizable vulnerability scanner based on simple YAML based DSL.

🧠 USE CASE

How GuardDuty Protects S3 from Malware

Some of you may know, AWS launched Amazon GuardDuty Malware Protection for S3 on 11 Jun 24, and I've noticed increased interest from organizations exploring this option.

And this is how it typically flows:

1. GuardDuty continuously monitors S3 objects using advanced threat detection.

2. When malware is detected, GuardDuty tags the files to make them visible for further investigation.

3. The malware is automatically quarantined to prevent further spread.

4. EventBridge monitors these malware events.

5. Upon detection, EventBridge triggers Lambda for automation tasks.

6. Lambda automates actions like moving infected files to a quarantine bucket, logging the incidents for tracking, and notifying teams for prompt response.

While enabling malware protection in GuardDuty for your S3 buckets:

• You can scan all objects in the S3 bucket or

• Filter out with a specific prefix.

Make sure the permissions that are required by GuardDuty to scan the buckets are Configured in the IAM role policy.

Find IAM role policy instructions here.

Key Pointers You Should Know: 

• You can enable Malware Protection for S3 in your account's S3 bucket, but not for member accounts as a delegated admin.

• This feature is only available for S3 buckets in the same Region selected in the GuardDuty console; cross-Region buckets aren't supported.

• Receive EventBridge notifications for plan status changes in member accounts' buckets.

• Detects malicious file uploads in selected S3 buckets.

• If GuardDuty is not enabled, you can still enable only Malware Protection for S3.

Scanned objects are tagged with GuardDutyMalwareScanStatus with these values:

For further exploration:

Monitoring S3 object scans in Malware Protection for S3

Using tag-based access control (TBAC) with Malware Protection for S3

Hope you find this use case helpful in your learning journey !

Looking to promote your company, product, service, or event to 15,000+ TechOps Professionals? Let's work together.